Privacy Policy
Effective 10 November 2026
This policy explains what the Smart Workout app (Android, package com.scorpioniz.smartworkouttracker) and its server at api.smart-workout.eu do with your data. The data controller is Paulius Lukošiūnas, who runs Smart Workout as a sole trader in Lithuania (individual activity certificate No. 1310056). Contact: [email protected].
The short version
- There is no account, no login, no ads and no analytics or tracking SDK.
- Your workouts, templates, body measurements and settings are stored on your phone. Only workout summaries are sent (see below), never notes or names.
- The server only knows a random device ID, a scrambled phone ID, basic device info, the country you installed from, your nickname if you set one, when you accepted the Terms of Use, what you ask the AI, workout summaries linked to your device ID (which you can switch off) and whether you have PRO.
- If the app crashes, it sends a crash report that is not linked to you (see "Crash reports" below).
- We do not sell your data.
What the server receives
"Inactive" below means the server has received no request from your device: the app contacts the server every time it starts, so opening the app is enough to stay active.
| Data | Why | How long we keep it |
|---|---|---|
| Device ID: a random identifier the app creates on first launch, plus a sign-in token derived from it. | To recognise your device, count AI requests and link your PRO subscription to it. | As long as you use the app. Deleted automatically, with everything else on this list, after 24 months of inactivity, or sooner if you ask us. Not while a PRO subscription is still running. |
| Phone ID: a one-way hash of the Android ID that Android gives this app. It stays the same after a reinstall and differs from what other apps see. | To stop misuse of the AI, for example reinstalling to get more free requests, and to block a phone that abuses it. | Same as the device ID. If a phone is blocked for abuse, its hash is kept while the block lasts. |
| Device info: app version, Android version, phone model, language and time zone. | To keep the app working on your device and fix bugs. | Same as the device ID. Updated when the app starts. |
| Country: the country of the network your phone used when the app first contacted the server, as a two-letter code (for example LT). Cloudflare works it out from the IP address; we store only the country, never the IP address or a more precise location. | To see in aggregate which countries the app is used in, for example to decide which languages to add. | Same as the device ID. |
| Terms acceptance: the time you ticked "I agree to the Terms of Use" in the app and which version of the terms it was. | To show that you accepted the Terms of Use. | Same as the device ID. |
| Nickname (optional): the name you enter so the app can greet you. | To greet you in the app and in workout reminders. It is never sent to the AI or shared with anyone. | Until you clear it in Profile, otherwise the same as the device ID. |
| AI requests: the text you type into "Generate workout with AI", your optional "About you" answers (goal, experience, where you train, session length, days per week) and, once available, your average session length, a running summary (km a week, longest run, average pace; never where you ran) and your last five shared workouts from the past 30 days (date, length, exercises, and the reps and weight of each set), all from your shared workouts. | To create the workout plan you asked for, enforce the monthly AI limit and prevent abuse. | Same as the device ID. |
| Workout summaries (only when Profile → "Share workout stats" is on, which is the default): duration of each finished workout, the sets and minutes per exercise, the reps and weight of each set, the distance you typed for cardio such as a run and its planned type (easy, intervals or long; never your location), and a number identifying which of your templates it came from (the number only, never the template's name). No notes, names or body measurements. | To make AI plans fit how long and what you really train, to see in aggregate which features and exercises are used, and to look at your own summaries when helping you with a support request or a problem with your account. | 12 months, then deleted automatically. |
| Crash reports: when the app crashes or hits an unexpected error, the error and where in the code it happened, the app and Android version, the phone model and the server addresses the app called just before. No device ID, IP address, screenshots, workout contents or anything you typed. | To find and fix bugs. | Kept by Sentry for up to 90 days, then deleted automatically. |
| Subscription status: purchase, renewal, cancellation and expiry events for PRO, received from Google Play through RevenueCat. We never see your payment card details. | To unlock PRO on the server and handle refunds and disputes. | Same as the device ID. Google Play keeps its own purchase records under Google's privacy policy. |
Legal bases (GDPR)
- Performance of a contract (Art. 6(1)(b)): running the features you use, including AI generation and PRO.
- Legitimate interests (Art. 6(1)(f)): preventing abuse of the AI feature, fixing bugs and improving the app with workout summaries. You can object at any time; for workout summaries just switch off "Share workout stats" in Profile.
Service providers
We use these companies to run the service. They process data only on our behalf, except where noted.
- Our hosting provider: runs the server and database.
- Cloudflare: network security and delivery for api.smart-workout.eu; it handles requests in transit.
- Google (Gemini API): turns your AI request into a workout plan. While Smart Workout uses the free tier of the Gemini API, Google may use these requests to improve its products. The app never asks for health or medical details: do not put them (for example injuries, pain or illnesses), or any other personal details, into AI requests.
- Sentry: receives error reports when the server fails or the app crashes, so they can be fixed. A server report holds the error and the address that was called, without your IP address, request contents or sign-in token. An app crash report is described under "Crash reports" above and is not linked to your device ID.
- RevenueCat and Google Play: process subscriptions. Google Play handles the payment itself under Google's own privacy policy.
Some of these providers are based in the United States. Transfers rely on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
Your rights
You can ask for a copy of your data, its correction or deletion, restriction of processing, or object to processing. Because there is no account, include the Device ID shown on the app's Profile screen in your email to [email protected] so we can find your data. Deleting it also removes your AI history. An active subscription must be cancelled separately in Google Play.
Uninstalling the app deletes everything stored on your phone. You also have the right to complain to a data protection authority, in Lithuania the State Data Protection Inspectorate (vdai.lrv.lt).
Security
All traffic uses HTTPS. The sign-in token is kept in your phone's secure storage (Android Keystore). Admin access to the server is password protected and limited to the developer.
Children
Smart Workout is meant for adults and is not directed at children under 16. We do not knowingly collect data from children.
Changes
If this policy changes, we update this page and its effective date. Significant changes are announced in the app's release notes.